feat: add independent managed SSH agent packages
Managed SSH previously tied remote Agent and Runtime artifacts to desktop packaging and Host activation. Settings now manages verified Linux x64 and arm64 .gbagent packages explicitly, with source-aligned download and update plus offline import and export. Each package contains the signed Agent, pinned Node, and compatible OpenCode Runtime, and project activation never downloads one automatically. Dedicated native CI and a protected release workflow publish deterministic, signed cumulative catalogs to GitHub and Beijing OSS without replacing the desktop Latest release. Desktop packaging is metadata-only, remains independent of Agent artifacts and signing credentials, and Linux desktop releases add RPM installers. The managed SSH path also keeps model credentials in Main, enforces Ask as read-only, verifies signed Agent and Runtime inputs, preserves ACP recovery, and reports Host update cancellation and failures accurately. Release note: 远程项目现可在“设置”中手动下载、更新或离线导入签名 Agent 包，桌面安装包与远程组件发布相互独立；Linux 桌面版同时新增 RPM 安装包。
This commit is contained in:
mesalogo
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,178 @@
|
||||
import { readFileSync } from 'node:fs'
|
||||
import { join } from 'node:path'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { parse } from 'yaml'
|
||||
|
||||
const workflow = readFileSync(
|
||||
join(
|
||||
process.cwd(),
|
||||
'.github',
|
||||
'workflows',
|
||||
'agent-release.yml'
|
||||
),
|
||||
'utf8'
|
||||
)
|
||||
const desktopWorkflow = readFileSync(
|
||||
join(process.cwd(), '.github', 'workflows', 'packages.yml'),
|
||||
'utf8'
|
||||
)
|
||||
const parsed = parse(workflow) as {
|
||||
jobs: Record<
|
||||
string,
|
||||
{
|
||||
needs?: string | string[]
|
||||
environment?: { name?: string }
|
||||
strategy?: {
|
||||
matrix?: {
|
||||
include?: Array<Record<string, unknown>>
|
||||
}
|
||||
}
|
||||
steps?: Array<{
|
||||
name?: string
|
||||
run?: string
|
||||
uses?: string
|
||||
with?: Record<string, unknown>
|
||||
}>
|
||||
}
|
||||
>
|
||||
}
|
||||
|
||||
function serializedJob(name: string): string {
|
||||
return JSON.stringify(parsed.jobs[name])
|
||||
}
|
||||
|
||||
function scripts(name: string): string {
|
||||
return (
|
||||
parsed.jobs[name]?.steps
|
||||
?.map((step) => step.run ?? '')
|
||||
.join('\n') ?? ''
|
||||
)
|
||||
}
|
||||
|
||||
describe('independent Agent release workflow', () => {
|
||||
it('uses a separate immutable agent-v tag and never enters desktop packaging', () => {
|
||||
expect(() => parse(workflow)).not.toThrow()
|
||||
expect(workflow).toContain("- 'agent-v*'")
|
||||
expect(workflow).not.toContain('workflow_dispatch:')
|
||||
expect(scripts('authorize')).toContain(
|
||||
"require('./agent-runtime-lock.json').agentVersion"
|
||||
)
|
||||
expect(scripts('authorize')).toContain(
|
||||
'git cat-file -t "refs/tags/$GITHUB_REF_NAME"'
|
||||
)
|
||||
expect(scripts('authorize')).toContain(
|
||||
'git merge-base --is-ancestor'
|
||||
)
|
||||
expect(workflow).not.toContain('release:package')
|
||||
expect(desktopWorkflow).not.toContain(
|
||||
'agent-release.yml'
|
||||
)
|
||||
})
|
||||
|
||||
it('builds native x64 and arm64 compound packages in the protected signing environment', () => {
|
||||
expect(
|
||||
parsed.jobs.build?.strategy?.matrix?.include
|
||||
).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
arch: 'x64',
|
||||
runner: 'ubuntu-24.04'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
arch: 'arm64',
|
||||
runner: 'ubuntu-24.04-arm'
|
||||
})
|
||||
])
|
||||
)
|
||||
expect(parsed.jobs.build?.environment?.name).toBe(
|
||||
'agent-signing'
|
||||
)
|
||||
const build = serializedJob('build')
|
||||
const buildScripts = scripts('build')
|
||||
expect(buildScripts).toContain(
|
||||
'node build/agent-package.cjs build'
|
||||
)
|
||||
expect(buildScripts).toContain(
|
||||
'--registry https://registry.npmjs.org/'
|
||||
)
|
||||
expect(buildScripts).toContain('--ignore-scripts')
|
||||
expect(build).toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
expect(build).toContain(
|
||||
'GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
expect(buildScripts).toContain('.gbagent')
|
||||
})
|
||||
|
||||
it('signs and verifies one cumulative dual-architecture catalog', () => {
|
||||
expect(parsed.jobs.catalog?.environment?.name).toBe(
|
||||
'agent-signing'
|
||||
)
|
||||
const catalog = scripts('catalog')
|
||||
expect(catalog).toContain(
|
||||
'node build/agent-catalog.cjs create'
|
||||
)
|
||||
expect(catalog).toContain('--x64-package')
|
||||
expect(catalog).toContain('--arm64-package')
|
||||
expect(catalog).toContain(
|
||||
'--previous-catalog dist/agent-release/previous.json'
|
||||
)
|
||||
expect(catalog).toContain(
|
||||
'node build/agent-catalog.cjs verify'
|
||||
)
|
||||
})
|
||||
|
||||
it('publishes immutable OSS objects and updates the signed latest pointer last', () => {
|
||||
expect(parsed.jobs.publish?.environment?.name).toBe(
|
||||
'aliyun-oss-release'
|
||||
)
|
||||
const publish = scripts('publish')
|
||||
const immutable = workflow.indexOf(
|
||||
'- name: Upload immutable Agent release to OSS'
|
||||
)
|
||||
const github = workflow.indexOf(
|
||||
'- name: Publish non-Latest GitHub Agent release'
|
||||
)
|
||||
const latest = workflow.indexOf(
|
||||
'- name: Point OSS Agent catalog to published release'
|
||||
)
|
||||
expect(immutable).toBeGreaterThanOrEqual(0)
|
||||
expect(github).toBeGreaterThan(immutable)
|
||||
expect(latest).toBeGreaterThan(github)
|
||||
expect(serializedJob('publish')).toContain(
|
||||
'aliyun/configure-aliyun-credentials-action@v1'
|
||||
)
|
||||
expect(publish).toContain('--region "$OSS_REGION"')
|
||||
expect(publish).toContain(
|
||||
'$root/$name" --output "$RUNNER_TEMP/immutable-$name"'
|
||||
)
|
||||
})
|
||||
|
||||
it('publishes a normal Agent release without changing desktop Latest', () => {
|
||||
const publish = scripts('publish')
|
||||
expect(publish).toContain('--latest=false')
|
||||
expect(publish).toContain(
|
||||
'repos/mesalogo/goodbuddy/releases/latest'
|
||||
)
|
||||
expect(publish).toContain(
|
||||
'test "$(gh api repos/mesalogo/goodbuddy/releases/latest --jq .tag_name)" != "$tag"'
|
||||
)
|
||||
expect(publish).not.toContain('--latest\n')
|
||||
expect(publish).not.toContain('agent-releases/latest.sig')
|
||||
expect(publish).toContain(
|
||||
'catalog: `v${version}/agent-catalog.json`'
|
||||
)
|
||||
expect(workflow).not.toContain('prerelease: true')
|
||||
})
|
||||
|
||||
it('keeps private keys out of authorization and public publication jobs', () => {
|
||||
expect(serializedJob('authorize')).not.toContain('secrets.')
|
||||
expect(serializedJob('publish')).not.toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
expect(serializedJob('publish')).not.toContain(
|
||||
'GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,218 @@
|
||||
import { readFileSync } from 'node:fs'
|
||||
import { createRequire } from 'node:module'
|
||||
import { join } from 'node:path'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { parse } from 'yaml'
|
||||
|
||||
const workflowPath = join(
|
||||
process.cwd(),
|
||||
'.github',
|
||||
'workflows',
|
||||
'agents.yml'
|
||||
)
|
||||
const workflow = readFileSync(workflowPath, 'utf8')
|
||||
const ciBundleSource = readFileSync(
|
||||
join(process.cwd(), 'build', 'agent-ci-bundle.cjs'),
|
||||
'utf8'
|
||||
)
|
||||
const parsedWorkflow = parse(workflow) as {
|
||||
jobs: Record<
|
||||
string,
|
||||
{
|
||||
needs?: string | string[]
|
||||
strategy?: {
|
||||
matrix?: {
|
||||
include?: Array<Record<string, unknown>>
|
||||
}
|
||||
}
|
||||
steps?: Array<{
|
||||
name?: string
|
||||
run?: string
|
||||
uses?: string
|
||||
with?: Record<string, unknown>
|
||||
}>
|
||||
}
|
||||
>
|
||||
}
|
||||
|
||||
type AgentCiBundleModule = {
|
||||
parseArguments(argv: string[]): {
|
||||
arch: 'x64' | 'arm64'
|
||||
nodeArchive: string
|
||||
opencodeArchive: string
|
||||
outputDirectory: string
|
||||
archive: string
|
||||
}
|
||||
}
|
||||
|
||||
const require = createRequire(import.meta.url)
|
||||
const agentCiBundle = require(
|
||||
'../build/agent-ci-bundle.cjs'
|
||||
) as AgentCiBundleModule
|
||||
|
||||
function serializedJob(name: string): string {
|
||||
return JSON.stringify(parsedWorkflow.jobs[name])
|
||||
}
|
||||
|
||||
function jobScripts(name: string): string {
|
||||
return (
|
||||
parsedWorkflow.jobs[name]?.steps
|
||||
?.map((step) => step.run ?? '')
|
||||
.join('\n') ?? ''
|
||||
)
|
||||
}
|
||||
|
||||
describe('GoodBuddy Agents workflow', () => {
|
||||
it('uses valid YAML, bounded permissions, and pinned action majors', () => {
|
||||
expect(() => parse(workflow)).not.toThrow()
|
||||
expect(workflow).toContain('name: GoodBuddy Agents')
|
||||
expect(workflow).toContain('contents: read')
|
||||
expect(workflow).toContain('pull_request:')
|
||||
expect(workflow).toContain('push:')
|
||||
expect(workflow).toContain('workflow_dispatch:')
|
||||
|
||||
const references = [
|
||||
...workflow.matchAll(
|
||||
/uses:\s+(actions\/(?:checkout|setup-node|cache)@v\d+)/gu
|
||||
)
|
||||
].map((match) => match[1])
|
||||
expect(new Set(references)).toEqual(
|
||||
new Set([
|
||||
'actions/checkout@v7',
|
||||
'actions/setup-node@v7',
|
||||
'actions/cache@v6'
|
||||
])
|
||||
)
|
||||
expect(workflow).not.toContain('permissions: write')
|
||||
expect(workflow).not.toContain('actions/upload-artifact')
|
||||
expect(workflow).not.toContain("- 'AGENTS.md'")
|
||||
expect(workflow.match(/'src\/shared\/\*\*'/gu)).toHaveLength(2)
|
||||
})
|
||||
|
||||
it('builds both Agent architectures on native Linux runners', () => {
|
||||
expect(
|
||||
parsedWorkflow.jobs.build?.strategy?.matrix?.include
|
||||
).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
arch: 'x64',
|
||||
runner: 'ubuntu-24.04'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
arch: 'arm64',
|
||||
runner: 'ubuntu-24.04-arm'
|
||||
})
|
||||
])
|
||||
)
|
||||
expect(parsedWorkflow.jobs.build?.needs).toBe('validate')
|
||||
expect(serializedJob('build')).toContain(
|
||||
'"runs-on":"${{ matrix.runner }}"'
|
||||
)
|
||||
expect(jobScripts('build')).toContain(
|
||||
'src/agent-daemon/model-bridge.test.ts'
|
||||
)
|
||||
expect(jobScripts('build')).toContain(
|
||||
'src/agent-daemon/lifecycle.test.ts'
|
||||
)
|
||||
expect(jobScripts('validate')).not.toContain(
|
||||
'src/agent-daemon/model-bridge.test.ts'
|
||||
)
|
||||
expect(jobScripts('validate')).not.toContain(
|
||||
'src/agent-daemon/lifecycle.test.ts'
|
||||
)
|
||||
})
|
||||
|
||||
it('resolves and verifies the locked official Node runtime', () => {
|
||||
const scripts = jobScripts('build')
|
||||
expect(scripts).toContain(
|
||||
"require('./agent-runtime-lock.json')"
|
||||
)
|
||||
expect(scripts).toContain("url.protocol !== 'https:'")
|
||||
expect(scripts).toContain("url.hostname !== 'nodejs.org'")
|
||||
expect(scripts).toContain(
|
||||
"curl --proto '=https' --tlsv1.2"
|
||||
)
|
||||
expect(scripts).toContain('--max-filesize 104857600')
|
||||
expect(scripts).toContain('sha256sum --check --strict -')
|
||||
expect(serializedJob('build')).toContain('actions/cache@v6')
|
||||
})
|
||||
|
||||
it('resolves and verifies the locked official OpenCode Runtime', () => {
|
||||
const scripts = jobScripts('build')
|
||||
expect(scripts).toContain(
|
||||
"require('./remote-runtime-lock.json')"
|
||||
)
|
||||
expect(scripts).toContain(
|
||||
'--registry https://registry.npmjs.org/'
|
||||
)
|
||||
expect(scripts).toContain('--ignore-scripts')
|
||||
expect(scripts).toContain(
|
||||
'OpenCode Runtime archive integrity mismatch'
|
||||
)
|
||||
expect(serializedJob('build')).toContain('actions/cache@v6')
|
||||
})
|
||||
|
||||
it('uses only ephemeral test signing and publishes no package', () => {
|
||||
const build = serializedJob('build')
|
||||
expect(build).toContain(
|
||||
'node build/agent-ci-bundle.cjs'
|
||||
)
|
||||
expect(build).toContain(
|
||||
'deterministic archive comparison passed'
|
||||
)
|
||||
expect(workflow).not.toContain('secrets.')
|
||||
expect(workflow).not.toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
expect(ciBundleSource).toContain(
|
||||
"generateKeyPairSync('ed25519')"
|
||||
)
|
||||
expect(ciBundleSource).toContain(
|
||||
"environment: 'test'"
|
||||
)
|
||||
expect(ciBundleSource).toContain('testSigningIdentity')
|
||||
expect(ciBundleSource).toContain(
|
||||
'Agent CI archives are not deterministic'
|
||||
)
|
||||
expect(ciBundleSource).toContain('assembleAgentPackage')
|
||||
expect(ciBundleSource).toContain('buildRuntimeBundle')
|
||||
expect(build).toContain('.gbagent')
|
||||
expect(ciBundleSource).not.toContain(
|
||||
'readTrustedKeyRegistry'
|
||||
)
|
||||
expect(ciBundleSource).not.toContain('writeFileSync')
|
||||
})
|
||||
|
||||
it('parses only explicit bounded CI build arguments', () => {
|
||||
expect(
|
||||
agentCiBundle.parseArguments([
|
||||
'--arch',
|
||||
'arm64',
|
||||
'--node-archive',
|
||||
'node.tar.gz',
|
||||
'--opencode-archive',
|
||||
'opencode.tgz',
|
||||
'--output-directory',
|
||||
'bundle',
|
||||
'--archive',
|
||||
'goodbuddy-agent-1.0.0-linux-arm64.gbagent'
|
||||
])
|
||||
).toMatchObject({ arch: 'arm64' })
|
||||
expect(() =>
|
||||
agentCiBundle.parseArguments([
|
||||
'--arch',
|
||||
'x64',
|
||||
'--node-archive',
|
||||
'node.tar.gz',
|
||||
'--opencode-archive',
|
||||
'opencode.tgz',
|
||||
'--output-directory',
|
||||
'bundle',
|
||||
'--archive',
|
||||
'goodbuddy-agent-1.0.0-linux-x64.gbagent',
|
||||
'--private-key',
|
||||
'secret'
|
||||
])
|
||||
).toThrow('Unknown Agent CI bundle argument')
|
||||
})
|
||||
})
|
||||
@@ -156,7 +156,7 @@ describe('release asset aggregation', () => {
|
||||
])
|
||||
|
||||
const outputNames = readdirSync(output)
|
||||
expect(outputNames).toHaveLength(20)
|
||||
expect(outputNames).toHaveLength(22)
|
||||
expect(outputNames).toContain('release-manifest.json')
|
||||
expect(outputNames).toContain('SHA256SUMS')
|
||||
expect(outputNames).not.toContain('builder-debug.yml')
|
||||
@@ -180,7 +180,7 @@ describe('release asset aggregation', () => {
|
||||
join(output, 'SHA256SUMS'),
|
||||
'utf8'
|
||||
)
|
||||
expect(sums.trim().split('\n')).toHaveLength(19)
|
||||
expect(sums.trim().split('\n')).toHaveLength(21)
|
||||
expect(sums).toContain(
|
||||
'release-manifest-windows-x64.json'
|
||||
)
|
||||
|
||||
+44
-237
@@ -1,45 +1,17 @@
|
||||
import {
|
||||
existsSync,
|
||||
mkdtempSync,
|
||||
mkdirSync,
|
||||
readFileSync,
|
||||
mkdtempSync,
|
||||
rmSync,
|
||||
writeFileSync
|
||||
} from 'node:fs'
|
||||
import { createRequire } from 'node:module'
|
||||
import { tmpdir } from 'node:os'
|
||||
import { dirname, join } from 'node:path'
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
|
||||
|
||||
type Architecture = 'x64' | 'arm64'
|
||||
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
|
||||
|
||||
interface PortableBuilderModule {
|
||||
assertPortableOutput: (
|
||||
directory: string,
|
||||
architectures?: Architecture[]
|
||||
) => void
|
||||
discoverLocalAgentResources: (
|
||||
projectRoot: string
|
||||
) => Architecture[]
|
||||
embedPortableAgentResources: (
|
||||
directory: string,
|
||||
options: {
|
||||
projectRoot: string
|
||||
requiredArchitectures?: Architecture[]
|
||||
verifyLockedBundle?: (
|
||||
directory: string,
|
||||
architecture: Architecture,
|
||||
options: { projectRoot: string }
|
||||
) => void
|
||||
}
|
||||
) => Architecture[]
|
||||
parseRequiredAgentArchitectures: (
|
||||
value: string | undefined
|
||||
) => Architecture[]
|
||||
portableRequiredPaths: (
|
||||
directory: string,
|
||||
architectures?: Architecture[]
|
||||
) => string[]
|
||||
assertPortableOutput(directory: string): void
|
||||
portableRequiredPaths(directory: string): string[]
|
||||
}
|
||||
|
||||
const require = createRequire(import.meta.url)
|
||||
@@ -48,232 +20,67 @@ const portableBuilder = require(
|
||||
) as PortableBuilderModule
|
||||
|
||||
let directory: string
|
||||
let projectRoot: string
|
||||
let unpackedDirectory: string
|
||||
|
||||
function createAgentResource(
|
||||
architecture: Architecture,
|
||||
contents: string = architecture
|
||||
): string {
|
||||
const resource = join(
|
||||
projectRoot,
|
||||
'.agent-resources',
|
||||
`linux-${architecture}`
|
||||
)
|
||||
mkdirSync(join(resource, 'lib'), { recursive: true })
|
||||
writeFileSync(join(resource, 'manifest.json'), contents)
|
||||
writeFileSync(join(resource, 'manifest.sig'), 'signature')
|
||||
writeFileSync(join(resource, 'goodbuddy-agent'), 'launcher')
|
||||
writeFileSync(join(resource, 'node'), 'runtime')
|
||||
writeFileSync(join(resource, 'lib', 'agent.cjs'), 'agent')
|
||||
return resource
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
directory = mkdtempSync(join(tmpdir(), 'goodbuddy-portable-test-'))
|
||||
projectRoot = join(directory, 'project')
|
||||
unpackedDirectory = join(directory, 'win-unpacked')
|
||||
mkdirSync(projectRoot, { recursive: true })
|
||||
mkdirSync(unpackedDirectory, { recursive: true })
|
||||
directory = mkdtempSync(
|
||||
join(tmpdir(), 'goodbuddy-portable-test-')
|
||||
)
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
rmSync(directory, { recursive: true, force: true })
|
||||
})
|
||||
|
||||
describe('Portable Agent resources', () => {
|
||||
it('parses and deduplicates required architectures', () => {
|
||||
expect(
|
||||
portableBuilder.parseRequiredAgentArchitectures(undefined)
|
||||
).toEqual([])
|
||||
expect(
|
||||
portableBuilder.parseRequiredAgentArchitectures(
|
||||
' x64,arm64,x64 '
|
||||
)
|
||||
).toEqual(['x64', 'arm64'])
|
||||
expect(() =>
|
||||
portableBuilder.parseRequiredAgentArchitectures('')
|
||||
).toThrow('仅支持逗号分隔的 x64 和 arm64')
|
||||
expect(() =>
|
||||
portableBuilder.parseRequiredAgentArchitectures('x64,ia32')
|
||||
).toThrow('仅支持逗号分隔的 x64 和 arm64')
|
||||
})
|
||||
|
||||
it('discovers only local Agent resource directories', () => {
|
||||
createAgentResource('arm64')
|
||||
const nonDirectory = join(
|
||||
projectRoot,
|
||||
'.agent-resources',
|
||||
'linux-x64'
|
||||
)
|
||||
writeFileSync(nonDirectory, 'not a directory')
|
||||
|
||||
expect(
|
||||
portableBuilder.discoverLocalAgentResources(projectRoot)
|
||||
).toEqual(['arm64'])
|
||||
})
|
||||
|
||||
it('verifies every discovered bundle before copying it', () => {
|
||||
const x64Resource = createAgentResource('x64', 'x64 manifest')
|
||||
const arm64Resource = createAgentResource(
|
||||
'arm64',
|
||||
'arm64 manifest'
|
||||
)
|
||||
const verifyLockedBundle = vi.fn()
|
||||
|
||||
expect(
|
||||
portableBuilder.embedPortableAgentResources(
|
||||
unpackedDirectory,
|
||||
{
|
||||
projectRoot,
|
||||
requiredArchitectures: ['x64', 'arm64'],
|
||||
verifyLockedBundle
|
||||
}
|
||||
)
|
||||
).toEqual(['x64', 'arm64'])
|
||||
expect(verifyLockedBundle.mock.calls).toEqual([
|
||||
[x64Resource, 'x64', { projectRoot }],
|
||||
[arm64Resource, 'arm64', { projectRoot }]
|
||||
])
|
||||
expect(
|
||||
readFileSync(
|
||||
join(
|
||||
unpackedDirectory,
|
||||
'resources',
|
||||
'agents',
|
||||
'linux-x64',
|
||||
'manifest.json'
|
||||
),
|
||||
'utf8'
|
||||
)
|
||||
).toBe('x64 manifest')
|
||||
expect(
|
||||
readFileSync(
|
||||
join(
|
||||
unpackedDirectory,
|
||||
'resources',
|
||||
'agents',
|
||||
'linux-arm64',
|
||||
'manifest.json'
|
||||
),
|
||||
'utf8'
|
||||
)
|
||||
).toBe('arm64 manifest')
|
||||
})
|
||||
|
||||
it('copies no Agent bytes when strict verification fails', () => {
|
||||
createAgentResource('x64')
|
||||
createAgentResource('arm64')
|
||||
const verifyLockedBundle = vi.fn(
|
||||
(_resource: string, architecture: Architecture) => {
|
||||
if (architecture === 'arm64') {
|
||||
throw new Error('verification failed')
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
expect(() =>
|
||||
portableBuilder.embedPortableAgentResources(
|
||||
unpackedDirectory,
|
||||
{
|
||||
projectRoot,
|
||||
verifyLockedBundle
|
||||
}
|
||||
)
|
||||
).toThrow('verification failed')
|
||||
expect(
|
||||
existsSync(
|
||||
join(unpackedDirectory, 'resources', 'agents')
|
||||
)
|
||||
).toBe(false)
|
||||
})
|
||||
|
||||
it('fails when a required architecture is absent', () => {
|
||||
createAgentResource('x64')
|
||||
const verifyLockedBundle = vi.fn()
|
||||
|
||||
expect(() =>
|
||||
portableBuilder.embedPortableAgentResources(
|
||||
unpackedDirectory,
|
||||
{
|
||||
projectRoot,
|
||||
requiredArchitectures: ['x64', 'arm64'],
|
||||
verifyLockedBundle
|
||||
}
|
||||
)
|
||||
).toThrow('linux-arm64')
|
||||
expect(verifyLockedBundle).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('preserves metadata-only packaging when no resource exists', () => {
|
||||
const verifyLockedBundle = vi.fn()
|
||||
|
||||
expect(
|
||||
portableBuilder.embedPortableAgentResources(
|
||||
unpackedDirectory,
|
||||
{ projectRoot, verifyLockedBundle }
|
||||
)
|
||||
).toEqual([])
|
||||
expect(verifyLockedBundle).not.toHaveBeenCalled()
|
||||
expect(
|
||||
existsSync(
|
||||
join(unpackedDirectory, 'resources', 'agents')
|
||||
)
|
||||
).toBe(false)
|
||||
expect(
|
||||
portableBuilder.portableRequiredPaths(unpackedDirectory)
|
||||
).toContain(
|
||||
describe('Portable package resources', () => {
|
||||
it('requires metadata and local desktop Runtimes without remote payloads', () => {
|
||||
const requiredPaths =
|
||||
portableBuilder.portableRequiredPaths(directory)
|
||||
expect(requiredPaths).toContain(
|
||||
join(
|
||||
unpackedDirectory,
|
||||
directory,
|
||||
'resources',
|
||||
'agent-runtime-lock.json'
|
||||
)
|
||||
)
|
||||
expect(requiredPaths).toContain(
|
||||
join(
|
||||
directory,
|
||||
'resources',
|
||||
'remote-runtime-lock.json'
|
||||
)
|
||||
)
|
||||
expect(
|
||||
requiredPaths.some((path) =>
|
||||
path.includes(
|
||||
`${join('resources', 'agents')}`
|
||||
)
|
||||
)
|
||||
).toBe(false)
|
||||
expect(
|
||||
requiredPaths.some((path) =>
|
||||
path.includes(
|
||||
`${join('resources', 'remote-runtimes')}`
|
||||
)
|
||||
)
|
||||
).toBe(false)
|
||||
})
|
||||
|
||||
it('includes embedded Agent payloads in output assertions', () => {
|
||||
const requiredPaths = portableBuilder.portableRequiredPaths(
|
||||
unpackedDirectory,
|
||||
['arm64']
|
||||
)
|
||||
const missingPath = join(
|
||||
unpackedDirectory,
|
||||
'resources',
|
||||
'agents',
|
||||
'linux-arm64',
|
||||
'lib',
|
||||
'agent.cjs'
|
||||
)
|
||||
for (const requiredPath of requiredPaths) {
|
||||
if (requiredPath === missingPath) {
|
||||
continue
|
||||
}
|
||||
it('validates the metadata-only portable output', () => {
|
||||
const requiredPaths =
|
||||
portableBuilder.portableRequiredPaths(directory)
|
||||
const missingPath = requiredPaths.at(-1)
|
||||
expect(missingPath).toBeDefined()
|
||||
for (const requiredPath of requiredPaths.slice(0, -1)) {
|
||||
mkdirSync(dirname(requiredPath), { recursive: true })
|
||||
writeFileSync(requiredPath, 'required')
|
||||
}
|
||||
|
||||
expect(requiredPaths).toContain(
|
||||
join(
|
||||
unpackedDirectory,
|
||||
'resources',
|
||||
'agents',
|
||||
'linux-arm64',
|
||||
'manifest.json'
|
||||
)
|
||||
)
|
||||
expect(() =>
|
||||
portableBuilder.assertPortableOutput(
|
||||
unpackedDirectory,
|
||||
['arm64']
|
||||
)
|
||||
portableBuilder.assertPortableOutput(directory)
|
||||
).toThrow(missingPath)
|
||||
mkdirSync(dirname(missingPath), { recursive: true })
|
||||
writeFileSync(missingPath, 'agent')
|
||||
mkdirSync(dirname(missingPath!), { recursive: true })
|
||||
writeFileSync(missingPath!, 'required')
|
||||
expect(() =>
|
||||
portableBuilder.assertPortableOutput(
|
||||
unpackedDirectory,
|
||||
['arm64']
|
||||
)
|
||||
portableBuilder.assertPortableOutput(directory)
|
||||
).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
+51
-402
@@ -4,7 +4,6 @@ import {
|
||||
mkdirSync,
|
||||
readFileSync,
|
||||
rmSync,
|
||||
symlinkSync,
|
||||
writeFileSync
|
||||
} from 'node:fs'
|
||||
import { createHash } from 'node:crypto'
|
||||
@@ -12,7 +11,7 @@ import { createRequire } from 'node:module'
|
||||
import { tmpdir } from 'node:os'
|
||||
import { join } from 'node:path'
|
||||
import { Writable } from 'node:stream'
|
||||
import { describe, expect, it, vi } from 'vitest'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
|
||||
interface ReleaseOptions {
|
||||
platform: 'windows' | 'macos' | 'linux'
|
||||
@@ -24,17 +23,6 @@ interface ReleaseOptions {
|
||||
help: boolean
|
||||
}
|
||||
|
||||
type VerifyRemoteRuntimeBundle = (
|
||||
bundleDirectory: string,
|
||||
options: {
|
||||
projectRoot: string
|
||||
architecture: 'x64' | 'arm64'
|
||||
registry: Record<string, unknown>
|
||||
lock: Record<string, unknown>
|
||||
verificationEnvironment: 'production'
|
||||
}
|
||||
) => void
|
||||
|
||||
interface ReleaseBuilderModule {
|
||||
assertReplaceableOutput: (
|
||||
directory: string,
|
||||
@@ -162,27 +150,6 @@ interface ReleaseBuilderModule {
|
||||
options: ReleaseOptions
|
||||
) => void
|
||||
verifyPortableZip: (filePath: string) => void
|
||||
verifyReleaseAgentResources: (
|
||||
projectRoot?: string,
|
||||
verifyBundleMatrix?: (
|
||||
bundleRoot: string,
|
||||
options: { projectRoot: string }
|
||||
) => void
|
||||
) => void
|
||||
verifyReleaseRemoteRuntimeResources: (
|
||||
projectRoot?: string,
|
||||
verifyBundleMatrix?: (
|
||||
bundleRoot: string,
|
||||
options: { projectRoot: string }
|
||||
) => void
|
||||
) => void
|
||||
verifyRemoteRuntimeBundleMatrix: (
|
||||
resourcesRoot: string,
|
||||
options: {
|
||||
projectRoot: string
|
||||
verifyBundleDirectory: VerifyRemoteRuntimeBundle
|
||||
}
|
||||
) => void
|
||||
verifyArchiveIntegrity: (
|
||||
filePath: string,
|
||||
expectedIntegrity: string
|
||||
@@ -232,60 +199,6 @@ const windowsOptions: ReleaseOptions = {
|
||||
help: false
|
||||
}
|
||||
|
||||
function createRemoteRuntimeMatrixFixture(): {
|
||||
projectRoot: string
|
||||
resourcesRoot: string
|
||||
options: {
|
||||
projectRoot: string
|
||||
verifyBundleDirectory: VerifyRemoteRuntimeBundle
|
||||
}
|
||||
cleanup: () => void
|
||||
} {
|
||||
const projectRoot = mkdtempSync(
|
||||
join(tmpdir(), 'goodbuddy-release-runtime-')
|
||||
)
|
||||
const resourcesRoot = join(
|
||||
projectRoot,
|
||||
'.remote-runtime-resources'
|
||||
)
|
||||
mkdirSync(join(projectRoot, 'resources'), { recursive: true })
|
||||
writeFileSync(
|
||||
join(projectRoot, 'resources', 'agent-release-keys.json'),
|
||||
JSON.stringify({ formatVersion: 1 })
|
||||
)
|
||||
writeFileSync(
|
||||
join(projectRoot, 'remote-runtime-lock.json'),
|
||||
JSON.stringify({
|
||||
formatVersion: 1,
|
||||
runtimes: {
|
||||
opencode: {
|
||||
targets: {
|
||||
x64: {
|
||||
package: 'opencode-linux-x64-baseline',
|
||||
integrity: 'sha512-x64'
|
||||
},
|
||||
arm64: {
|
||||
package: 'opencode-linux-arm64',
|
||||
integrity: 'sha512-arm64'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
)
|
||||
return {
|
||||
projectRoot,
|
||||
resourcesRoot,
|
||||
options: {
|
||||
projectRoot,
|
||||
verifyBundleDirectory: vi.fn<VerifyRemoteRuntimeBundle>()
|
||||
},
|
||||
cleanup: () => {
|
||||
rmSync(projectRoot, { recursive: true, force: true })
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function pe(machine: number): Buffer {
|
||||
const buffer = Buffer.alloc(256)
|
||||
buffer.write('MZ', 0, 'ascii')
|
||||
@@ -389,7 +302,7 @@ describe('release build arguments', () => {
|
||||
it.each([
|
||||
['win32', 'x64', 'windows', ['nsis', 'portable']],
|
||||
['darwin', 'arm64', 'macos', ['dmg', 'zip']],
|
||||
['linux', 'x64', 'linux', ['AppImage', 'deb']]
|
||||
['linux', 'x64', 'linux', ['AppImage', 'deb', 'rpm']]
|
||||
])(
|
||||
'uses %s host defaults',
|
||||
(host, arch, platform, formats) => {
|
||||
@@ -432,7 +345,7 @@ describe('release build arguments', () => {
|
||||
it.each([
|
||||
[['--platform', 'freebsd'], '不支持当前系统'],
|
||||
[['--arch', 'ia32'], '不支持的架构'],
|
||||
[['--format', 'rpm'], '不支持打包格式'],
|
||||
[['--format', 'zip'], '不支持打包格式'],
|
||||
[['--platform', 'linux', '--unsigned'], '仅支持 macOS'],
|
||||
[['--unknown'], '未知参数']
|
||||
])('rejects invalid arguments', (arguments_, message) => {
|
||||
@@ -483,278 +396,6 @@ describe('release build arguments', () => {
|
||||
).toBe(false)
|
||||
})
|
||||
|
||||
it('verifies both Agent bundles through the release preflight', () => {
|
||||
const projectRoot = join('workspace', 'goodbuddy')
|
||||
const verifyBundleMatrix = vi.fn()
|
||||
|
||||
releaseBuilder.verifyReleaseAgentResources(
|
||||
projectRoot,
|
||||
verifyBundleMatrix
|
||||
)
|
||||
|
||||
expect(verifyBundleMatrix).toHaveBeenCalledOnce()
|
||||
expect(verifyBundleMatrix).toHaveBeenCalledWith(
|
||||
join(projectRoot, '.agent-resources'),
|
||||
{ projectRoot }
|
||||
)
|
||||
expect(() =>
|
||||
releaseBuilder.verifyReleaseAgentResources(
|
||||
projectRoot,
|
||||
() => {
|
||||
throw new Error('invalid Agent bundle')
|
||||
}
|
||||
)
|
||||
).toThrow('invalid Agent bundle')
|
||||
})
|
||||
|
||||
it('verifies both remote Runtime bundles through the release preflight', () => {
|
||||
const projectRoot = join('workspace', 'goodbuddy')
|
||||
const verifyBundleMatrix = vi.fn()
|
||||
|
||||
releaseBuilder.verifyReleaseRemoteRuntimeResources(
|
||||
projectRoot,
|
||||
verifyBundleMatrix
|
||||
)
|
||||
|
||||
expect(verifyBundleMatrix).toHaveBeenCalledOnce()
|
||||
expect(verifyBundleMatrix).toHaveBeenCalledWith(
|
||||
join(projectRoot, '.remote-runtime-resources'),
|
||||
{ projectRoot }
|
||||
)
|
||||
expect(() =>
|
||||
releaseBuilder.verifyReleaseRemoteRuntimeResources(
|
||||
projectRoot,
|
||||
() => {
|
||||
throw new Error('invalid remote Runtime bundle')
|
||||
}
|
||||
)
|
||||
).toThrow('invalid remote Runtime bundle')
|
||||
})
|
||||
|
||||
it('discovers one canonical remote Runtime digest directory per architecture', () => {
|
||||
const projectRoot = mkdtempSync(
|
||||
join(tmpdir(), 'goodbuddy-release-runtime-')
|
||||
)
|
||||
const resourcesRoot = join(
|
||||
projectRoot,
|
||||
'.remote-runtime-resources'
|
||||
)
|
||||
const digests = {
|
||||
x64: '1'.repeat(64),
|
||||
arm64: '2'.repeat(64)
|
||||
}
|
||||
const registry = { formatVersion: 1 }
|
||||
const lock = {
|
||||
formatVersion: 1,
|
||||
runtimes: {
|
||||
opencode: {
|
||||
targets: {
|
||||
x64: {
|
||||
package: 'opencode-linux-x64-baseline',
|
||||
integrity: 'sha512-x64'
|
||||
},
|
||||
arm64: {
|
||||
package: 'opencode-linux-arm64',
|
||||
integrity: 'sha512-arm64'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
const verifyBundleDirectory = vi.fn()
|
||||
|
||||
try {
|
||||
mkdirSync(join(projectRoot, 'resources'), { recursive: true })
|
||||
writeFileSync(
|
||||
join(projectRoot, 'resources', 'agent-release-keys.json'),
|
||||
JSON.stringify(registry)
|
||||
)
|
||||
writeFileSync(
|
||||
join(projectRoot, 'remote-runtime-lock.json'),
|
||||
JSON.stringify(lock)
|
||||
)
|
||||
for (const architecture of ['x64', 'arm64'] as const) {
|
||||
mkdirSync(
|
||||
join(
|
||||
resourcesRoot,
|
||||
`linux-${architecture}`,
|
||||
'opencode',
|
||||
digests[architecture]
|
||||
),
|
||||
{ recursive: true }
|
||||
)
|
||||
}
|
||||
|
||||
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
|
||||
resourcesRoot,
|
||||
{ projectRoot, verifyBundleDirectory }
|
||||
)
|
||||
|
||||
expect(verifyBundleDirectory).toHaveBeenCalledTimes(2)
|
||||
for (const architecture of ['x64', 'arm64'] as const) {
|
||||
expect(verifyBundleDirectory).toHaveBeenCalledWith(
|
||||
join(
|
||||
resourcesRoot,
|
||||
`linux-${architecture}`,
|
||||
'opencode',
|
||||
digests[architecture]
|
||||
),
|
||||
{
|
||||
projectRoot,
|
||||
architecture,
|
||||
registry,
|
||||
lock,
|
||||
verificationEnvironment: 'production'
|
||||
}
|
||||
)
|
||||
}
|
||||
} finally {
|
||||
rmSync(projectRoot, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
it('rejects a missing remote Runtime digest directory', () => {
|
||||
const fixture = createRemoteRuntimeMatrixFixture()
|
||||
|
||||
try {
|
||||
mkdirSync(
|
||||
join(
|
||||
fixture.resourcesRoot,
|
||||
'linux-x64',
|
||||
'opencode'
|
||||
),
|
||||
{ recursive: true }
|
||||
)
|
||||
expect(() =>
|
||||
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
|
||||
fixture.resourcesRoot,
|
||||
fixture.options
|
||||
)
|
||||
).toThrow(
|
||||
/must contain exactly one digest directory for x64; found 0/u
|
||||
)
|
||||
} finally {
|
||||
fixture.cleanup()
|
||||
}
|
||||
})
|
||||
|
||||
it('rejects multiple remote Runtime digest directories', () => {
|
||||
const fixture = createRemoteRuntimeMatrixFixture()
|
||||
const runtimeRoot = join(
|
||||
fixture.resourcesRoot,
|
||||
'linux-x64',
|
||||
'opencode'
|
||||
)
|
||||
|
||||
try {
|
||||
mkdirSync(join(runtimeRoot, '1'.repeat(64)), {
|
||||
recursive: true
|
||||
})
|
||||
mkdirSync(join(runtimeRoot, '2'.repeat(64)))
|
||||
|
||||
expect(() =>
|
||||
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
|
||||
fixture.resourcesRoot,
|
||||
fixture.options
|
||||
)
|
||||
).toThrow(
|
||||
/must contain exactly one digest directory for x64; found 2/u
|
||||
)
|
||||
} finally {
|
||||
fixture.cleanup()
|
||||
}
|
||||
})
|
||||
|
||||
it('rejects malformed entries in a remote Runtime digest root', () => {
|
||||
const fixture = createRemoteRuntimeMatrixFixture()
|
||||
const runtimeRoot = join(
|
||||
fixture.resourcesRoot,
|
||||
'linux-x64',
|
||||
'opencode'
|
||||
)
|
||||
|
||||
try {
|
||||
mkdirSync(join(runtimeRoot, 'NOT-A-CANONICAL-DIGEST'), {
|
||||
recursive: true
|
||||
})
|
||||
|
||||
expect(() =>
|
||||
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
|
||||
fixture.resourcesRoot,
|
||||
fixture.options
|
||||
)
|
||||
).toThrow(
|
||||
/contains an unexpected entry for x64: NOT-A-CANONICAL-DIGEST/u
|
||||
)
|
||||
} finally {
|
||||
fixture.cleanup()
|
||||
}
|
||||
})
|
||||
|
||||
it('rejects non-directory remote Runtime digest entries', () => {
|
||||
const fixture = createRemoteRuntimeMatrixFixture()
|
||||
const runtimeRoot = join(
|
||||
fixture.resourcesRoot,
|
||||
'linux-x64',
|
||||
'opencode'
|
||||
)
|
||||
const digest = '1'.repeat(64)
|
||||
|
||||
try {
|
||||
mkdirSync(runtimeRoot, { recursive: true })
|
||||
writeFileSync(join(runtimeRoot, digest), 'not a bundle')
|
||||
|
||||
expect(() =>
|
||||
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
|
||||
fixture.resourcesRoot,
|
||||
fixture.options
|
||||
)
|
||||
).toThrow(
|
||||
new RegExp(
|
||||
`entry must be a real directory for x64: ${digest}`,
|
||||
'u'
|
||||
)
|
||||
)
|
||||
} finally {
|
||||
fixture.cleanup()
|
||||
}
|
||||
})
|
||||
|
||||
it('rejects symlinked remote Runtime digest directories', () => {
|
||||
const fixture = createRemoteRuntimeMatrixFixture()
|
||||
const runtimeRoot = join(
|
||||
fixture.resourcesRoot,
|
||||
'linux-x64',
|
||||
'opencode'
|
||||
)
|
||||
const digest = '1'.repeat(64)
|
||||
const target = join(fixture.projectRoot, 'runtime-target')
|
||||
|
||||
try {
|
||||
mkdirSync(runtimeRoot, { recursive: true })
|
||||
mkdirSync(target)
|
||||
symlinkSync(
|
||||
target,
|
||||
join(runtimeRoot, digest),
|
||||
process.platform === 'win32' ? 'junction' : 'dir'
|
||||
)
|
||||
|
||||
expect(() =>
|
||||
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
|
||||
fixture.resourcesRoot,
|
||||
fixture.options
|
||||
)
|
||||
).toThrow(
|
||||
new RegExp(
|
||||
`entry must be a real directory for x64: ${digest}`,
|
||||
'u'
|
||||
)
|
||||
)
|
||||
} finally {
|
||||
fixture.cleanup()
|
||||
}
|
||||
})
|
||||
|
||||
it('explicitly disables notarization for unsigned macOS packages', () => {
|
||||
const arguments_ =
|
||||
releaseBuilder.buildElectronBuilderArguments(
|
||||
@@ -851,7 +492,7 @@ describe('release build arguments', () => {
|
||||
releaseBuilder.targetRuntimePackageNames({
|
||||
...windowsOptions,
|
||||
platform: 'linux',
|
||||
formats: ['AppImage', 'deb']
|
||||
formats: ['AppImage', 'deb', 'rpm']
|
||||
})
|
||||
).toEqual([
|
||||
'@koromix/koffi-linux-x64',
|
||||
@@ -1172,55 +813,19 @@ describe('release build arguments', () => {
|
||||
).toBe(true)
|
||||
})
|
||||
|
||||
it('adds the complete Agent matrix only to release packages', () => {
|
||||
it('keeps remote Agent and Runtime payloads out of release packages', () => {
|
||||
const resourceEntries = releaseConfig.extraResources
|
||||
|
||||
expect(resourceEntries).toEqual(
|
||||
expect.arrayContaining([
|
||||
{
|
||||
from: 'resources/agent-release-keys.json',
|
||||
to: 'agent-release-keys.json'
|
||||
},
|
||||
{
|
||||
from: 'agent-runtime-lock.json',
|
||||
to: 'agent-runtime-lock.json'
|
||||
},
|
||||
{
|
||||
from: '.agent-resources/linux-x64',
|
||||
to: 'agents/linux-x64',
|
||||
filter: ['**/*']
|
||||
},
|
||||
{
|
||||
from: '.agent-resources/linux-arm64',
|
||||
to: 'agents/linux-arm64',
|
||||
filter: ['**/*']
|
||||
},
|
||||
{
|
||||
from: 'remote-runtime-lock.json',
|
||||
to: 'remote-runtime-lock.json'
|
||||
},
|
||||
{
|
||||
from: '.remote-runtime-resources/linux-x64',
|
||||
to: 'remote-runtimes/linux-x64',
|
||||
filter: ['**/*']
|
||||
},
|
||||
{
|
||||
from: '.remote-runtime-resources/linux-arm64',
|
||||
to: 'remote-runtimes/linux-arm64',
|
||||
filter: ['**/*']
|
||||
}
|
||||
])
|
||||
)
|
||||
expect(
|
||||
resourceEntries.filter((entry) =>
|
||||
entry.from.startsWith('.agent-resources/')
|
||||
)
|
||||
).toHaveLength(2)
|
||||
).toHaveLength(0)
|
||||
expect(
|
||||
resourceEntries.filter((entry) =>
|
||||
entry.from.startsWith('.remote-runtime-resources/')
|
||||
)
|
||||
).toHaveLength(2)
|
||||
).toHaveLength(0)
|
||||
expect(
|
||||
resourceEntries.filter(
|
||||
(entry) => entry.from === 'agent-runtime-lock.json'
|
||||
@@ -1564,4 +1169,48 @@ describe('release output safety', () => {
|
||||
rmSync(directory, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
it('validates AppImage, DEB, and RPM package signatures', () => {
|
||||
const directory = mkdtempSync(
|
||||
join(tmpdir(), 'goodbuddy-linux-artifacts-')
|
||||
)
|
||||
const options: ReleaseOptions = {
|
||||
platform: 'linux',
|
||||
arch: 'x64',
|
||||
formats: ['AppImage', 'deb', 'rpm'],
|
||||
skipBuild: false,
|
||||
dryRun: false,
|
||||
unsigned: false,
|
||||
help: false
|
||||
}
|
||||
try {
|
||||
writeFileSync(
|
||||
join(directory, 'GoodBuddy-linux-x86_64.AppImage'),
|
||||
elf(62)
|
||||
)
|
||||
writeFileSync(
|
||||
join(directory, 'GoodBuddy-linux-amd64.deb'),
|
||||
Buffer.from('!<arch>\n', 'ascii')
|
||||
)
|
||||
const rpm = Buffer.alloc(96)
|
||||
rpm.set([0xed, 0xab, 0xee, 0xdb])
|
||||
writeFileSync(
|
||||
join(directory, 'GoodBuddy-linux-x86_64.rpm'),
|
||||
rpm
|
||||
)
|
||||
|
||||
expect(() =>
|
||||
releaseBuilder.verifyArtifacts(directory, options)
|
||||
).not.toThrow()
|
||||
writeFileSync(
|
||||
join(directory, 'GoodBuddy-linux-x86_64.rpm'),
|
||||
'not-rpm'
|
||||
)
|
||||
expect(() =>
|
||||
releaseBuilder.verifyArtifacts(directory, options)
|
||||
).toThrow('RPM lead magic')
|
||||
} finally {
|
||||
rmSync(directory, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
})
|
||||
|
||||
+121
-260
@@ -7,29 +7,12 @@ const workflow = readFileSync(
|
||||
join(process.cwd(), '.github', 'workflows', 'packages.yml'),
|
||||
'utf8'
|
||||
)
|
||||
const runtimeLock = JSON.parse(
|
||||
readFileSync(
|
||||
join(process.cwd(), 'agent-runtime-lock.json'),
|
||||
'utf8'
|
||||
)
|
||||
) as {
|
||||
node: {
|
||||
version: string
|
||||
source: string
|
||||
targets: Record<
|
||||
string,
|
||||
{
|
||||
archive: string
|
||||
sha256: string
|
||||
}
|
||||
>
|
||||
}
|
||||
}
|
||||
const parsedWorkflow = parse(workflow) as {
|
||||
const parsed = parse(workflow) as {
|
||||
jobs: Record<
|
||||
string,
|
||||
{
|
||||
needs?: string | string[]
|
||||
environment?: { name?: string }
|
||||
strategy?: {
|
||||
matrix?: {
|
||||
include?: Array<Record<string, unknown>>
|
||||
@@ -46,27 +29,19 @@ const parsedWorkflow = parse(workflow) as {
|
||||
}
|
||||
|
||||
function serializedJob(name: string): string {
|
||||
return JSON.stringify(parsedWorkflow.jobs[name])
|
||||
return JSON.stringify(parsed.jobs[name])
|
||||
}
|
||||
|
||||
function jobScripts(name: string): string {
|
||||
return (
|
||||
parsedWorkflow.jobs[name]?.steps
|
||||
parsed.jobs[name]?.steps
|
||||
?.map((step) => step.run ?? '')
|
||||
.join('\n') ?? ''
|
||||
)
|
||||
}
|
||||
|
||||
function jobSteps(
|
||||
name: string
|
||||
): NonNullable<
|
||||
(typeof parsedWorkflow.jobs)[string]['steps']
|
||||
> {
|
||||
return parsedWorkflow.jobs[name]?.steps ?? []
|
||||
}
|
||||
|
||||
function jobNeeds(name: string): string[] {
|
||||
const needs = parsedWorkflow.jobs[name]?.needs
|
||||
const needs = parsed.jobs[name]?.needs
|
||||
return needs === undefined
|
||||
? []
|
||||
: Array.isArray(needs)
|
||||
@@ -74,286 +49,172 @@ function jobNeeds(name: string): string[] {
|
||||
: [needs]
|
||||
}
|
||||
|
||||
describe('packages workflow', () => {
|
||||
it('uses valid YAML and Node.js 24 GitHub Actions', () => {
|
||||
describe('desktop packages workflow', () => {
|
||||
it('uses valid YAML, pinned action majors, and only desktop release jobs', () => {
|
||||
expect(() => parse(workflow)).not.toThrow()
|
||||
|
||||
const references = [
|
||||
expect(Object.keys(parsed.jobs)).toEqual([
|
||||
'validate',
|
||||
'authorize-release',
|
||||
'package',
|
||||
'release'
|
||||
])
|
||||
const actionReferences = [
|
||||
...workflow.matchAll(
|
||||
/uses:\s+(actions\/(?:checkout|setup-node|cache|upload-artifact|download-artifact)@v\d+)/gu
|
||||
/uses:\s+((?:actions\/(?:checkout|setup-node|cache|upload-artifact|download-artifact)|aliyun\/configure-aliyun-credentials-action)@v\d+)/gu
|
||||
)
|
||||
].map((match) => match[1])
|
||||
|
||||
expect(new Set(references)).toEqual(
|
||||
expect(new Set(actionReferences)).toEqual(
|
||||
new Set([
|
||||
'actions/checkout@v7',
|
||||
'actions/setup-node@v7',
|
||||
'actions/cache@v6',
|
||||
'actions/upload-artifact@v7',
|
||||
'actions/download-artifact@v8'
|
||||
'actions/download-artifact@v8',
|
||||
'aliyun/configure-aliyun-credentials-action@v1'
|
||||
])
|
||||
)
|
||||
const setupNodeVersions = Object.values(parsedWorkflow.jobs)
|
||||
.flatMap((job) => job.steps ?? [])
|
||||
.filter((step) => step.uses === 'actions/setup-node@v7')
|
||||
.map((step) => step.with?.['node-version'])
|
||||
|
||||
expect(setupNodeVersions.length).toBeGreaterThanOrEqual(4)
|
||||
expect(new Set(setupNodeVersions)).toEqual(
|
||||
new Set([runtimeLock.node.version])
|
||||
)
|
||||
})
|
||||
|
||||
it('builds signed Agent bundles natively before the release package matrix', () => {
|
||||
const runtimeJob = serializedJob('agent-runtime')
|
||||
const signingJob = serializedJob('agent-signing')
|
||||
const signingMatrix =
|
||||
parsedWorkflow.jobs['agent-signing']?.strategy?.matrix
|
||||
?.include ?? []
|
||||
const packageDownload = jobSteps('package').find(
|
||||
(step) =>
|
||||
step.uses === 'actions/download-artifact@v8' &&
|
||||
step.with?.pattern !== undefined
|
||||
)
|
||||
|
||||
expect(signingMatrix).toContainEqual(
|
||||
expect.objectContaining({
|
||||
arch: 'arm64',
|
||||
runner: 'ubuntu-24.04-arm'
|
||||
})
|
||||
)
|
||||
expect(signingJob).toContain(
|
||||
expect(workflow).not.toContain('agent-signing:')
|
||||
expect(workflow).not.toContain('remote-runtime-signing:')
|
||||
expect(workflow).not.toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
expect(signingJob).toContain(
|
||||
'Preflight production Agent signing registry'
|
||||
)
|
||||
expect(signingJob).toContain(
|
||||
'node build/agent-bundle.cjs preflight'
|
||||
)
|
||||
for (const target of Object.values(runtimeLock.node.targets)) {
|
||||
expect(runtimeJob).toContain(target.archive)
|
||||
}
|
||||
expect(packageDownload?.with?.pattern).toBe(
|
||||
'goodbuddy-agent-linux-*'
|
||||
)
|
||||
const packageScripts = jobScripts('package')
|
||||
for (const targetName of Object.keys(runtimeLock.node.targets)) {
|
||||
expect(packageScripts).toContain(
|
||||
`--archive dist/agent-downloads/goodbuddy-agent-${targetName}.tar`
|
||||
)
|
||||
}
|
||||
expect(jobNeeds('package')).toEqual(
|
||||
expect.arrayContaining(['validate', 'agent-signing'])
|
||||
expect(workflow).not.toContain(
|
||||
'GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
})
|
||||
|
||||
it('imports Agent artifacts before invoking the explicit release packager', () => {
|
||||
it('packages all six desktop targets without remote component dependencies', () => {
|
||||
expect(
|
||||
parsed.jobs.package?.strategy?.matrix?.include
|
||||
).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
platform: 'windows',
|
||||
arch: 'x64',
|
||||
runner: 'windows-2025'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
platform: 'windows',
|
||||
arch: 'arm64',
|
||||
runner: 'windows-2025'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
platform: 'macos',
|
||||
arch: 'x64',
|
||||
runner: 'macos-15-intel'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
platform: 'macos',
|
||||
arch: 'arm64',
|
||||
runner: 'macos-15'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
platform: 'linux',
|
||||
arch: 'x64',
|
||||
runner: 'ubuntu-24.04'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
platform: 'linux',
|
||||
arch: 'arm64',
|
||||
runner: 'ubuntu-24.04-arm'
|
||||
})
|
||||
])
|
||||
)
|
||||
expect(jobNeeds('package')).toEqual([
|
||||
'validate',
|
||||
'authorize-release'
|
||||
])
|
||||
const scripts = jobScripts('package')
|
||||
const importIndex = scripts.indexOf(
|
||||
'node build/agent-bundle.cjs import'
|
||||
expect(scripts).toContain('npm run release:package')
|
||||
expect(scripts).not.toContain('agent-bundle.cjs import')
|
||||
expect(scripts).not.toContain(
|
||||
'remote-runtime-bundle.cjs import'
|
||||
)
|
||||
const releaseIndex = scripts.indexOf(
|
||||
'npm run release:package'
|
||||
expect(serializedJob('package')).not.toContain(
|
||||
'goodbuddy-agent-linux-'
|
||||
)
|
||||
expect(serializedJob('package')).not.toContain(
|
||||
'goodbuddy-opencode-linux-'
|
||||
)
|
||||
|
||||
expect(importIndex).toBeGreaterThanOrEqual(0)
|
||||
expect(releaseIndex).toBeGreaterThan(importIndex)
|
||||
expect(scripts).not.toContain('npm run dist')
|
||||
expect(scripts).not.toContain('npm run portable')
|
||||
})
|
||||
|
||||
it('authorizes signing only for protected-main commits and matching immutable version tags', () => {
|
||||
const authorization = serializedJob(
|
||||
'authorize-agent-signing'
|
||||
)
|
||||
const policy = jobScripts('authorize-agent-signing')
|
||||
|
||||
it('keeps desktop authorization tied to protected main and v tags', () => {
|
||||
const authorization = serializedJob('authorize-release')
|
||||
const policy = jobScripts('authorize-release')
|
||||
expect(authorization).toContain(
|
||||
"github.ref == 'refs/heads/main'"
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'git merge-base --is-ancestor'
|
||||
)
|
||||
expect(policy).toContain('git merge-base --is-ancestor')
|
||||
expect(policy).toContain(
|
||||
"require('./package.json').version"
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'GITHUB_EVENT_PATH).created'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'GITHUB_EVENT_PATH).forced'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'GITHUB_EVENT_PATH).deleted'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'test "$GITHUB_REF" = "refs/tags/$expected"'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'git cat-file -t "refs/tags/$GITHUB_REF_NAME"'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'refs/tags/$GITHUB_REF_NAME^{commit}'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'test "$GITHUB_REF" = "refs/heads/main"'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'test "$GITHUB_SHA" = "$(git rev-parse refs/remotes/origin/main)"'
|
||||
)
|
||||
expect(policy).toContain(
|
||||
'echo "authorized=true" >> "$GITHUB_OUTPUT"'
|
||||
)
|
||||
})
|
||||
|
||||
it('gates the only Agent private-key step behind the protected signing environment', () => {
|
||||
const signing = serializedJob('agent-signing')
|
||||
|
||||
expect(signing).toContain('"name":"agent-signing"')
|
||||
expect(signing).toContain(
|
||||
'"authorize-agent-signing"'
|
||||
)
|
||||
expect(signing).toContain(
|
||||
"needs.authorize-agent-signing.outputs.authorized == 'true'"
|
||||
)
|
||||
expect(signing).toContain(
|
||||
'${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}'
|
||||
)
|
||||
expect(signing.indexOf('Preflight production Agent signing registry'))
|
||||
.toBeLessThan(
|
||||
signing.indexOf(
|
||||
'${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}'
|
||||
)
|
||||
)
|
||||
expect(signing).not.toContain('"cache"')
|
||||
expect(signing).not.toContain('actions/cache')
|
||||
expect(
|
||||
workflow.match(
|
||||
/\$\{\{\s*secrets\.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY\s*\}\}/gu
|
||||
)
|
||||
).toHaveLength(1)
|
||||
})
|
||||
|
||||
it('keeps production signing inputs out of arbitrary-ref jobs', () => {
|
||||
for (const name of [
|
||||
'validate',
|
||||
'authorize-agent-signing',
|
||||
'agent-runtime'
|
||||
]) {
|
||||
expect(serializedJob(name)).not.toContain('secrets.')
|
||||
expect(serializedJob(name)).not.toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
||||
)
|
||||
}
|
||||
|
||||
expect(serializedJob('validate')).not.toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_KEY_ID'
|
||||
)
|
||||
expect(serializedJob('authorize-agent-signing')).not.toContain(
|
||||
'GOODBUDDY_AGENT_SIGNING_KEY_ID'
|
||||
)
|
||||
})
|
||||
|
||||
it('preserves unsigned validation while rejecting arbitrary refs from release jobs', () => {
|
||||
const validation = serializedJob('validate')
|
||||
const authorization = serializedJob(
|
||||
'authorize-agent-signing'
|
||||
)
|
||||
|
||||
expect(validation).toContain('npm test')
|
||||
expect(validation).toContain('npm run typecheck')
|
||||
expect(validation).toContain('npm run lint')
|
||||
expect(validation).toContain('npm run build:bundle')
|
||||
expect(authorization).toContain(
|
||||
"github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'"
|
||||
)
|
||||
expect(authorization).not.toContain(
|
||||
"github.event_name == 'workflow_dispatch' || github.ref_type == 'tag'"
|
||||
)
|
||||
expect(serializedJob('package')).toContain(
|
||||
"needs.authorize-agent-signing.outputs.authorized == 'true'"
|
||||
"needs.authorize-release.outputs.authorized == 'true'"
|
||||
)
|
||||
})
|
||||
|
||||
it('acquires every locked Agent runtime securely on cold runners', () => {
|
||||
const runtimeJob = serializedJob('agent-runtime')
|
||||
const runtimeScripts = jobScripts('agent-runtime')
|
||||
const signingJob = serializedJob('agent-signing')
|
||||
const runtimeUses = jobSteps('agent-runtime')
|
||||
.map((step) => step.uses)
|
||||
.filter((value) => value !== undefined)
|
||||
const runtimeUpload = jobSteps('agent-runtime').find(
|
||||
(step) =>
|
||||
step.uses === 'actions/upload-artifact@v7'
|
||||
it('installs RPM tooling and invokes the explicit native packager', () => {
|
||||
const packageJob = serializedJob('package')
|
||||
const scripts = jobScripts('package')
|
||||
expect(packageJob).toContain('Install RPM packaging tools')
|
||||
expect(packageJob).toContain(
|
||||
"matrix.platform == 'linux'"
|
||||
)
|
||||
|
||||
for (const target of Object.values(runtimeLock.node.targets)) {
|
||||
expect(runtimeJob).toContain(
|
||||
new URL(target.archive, runtimeLock.node.source).toString()
|
||||
)
|
||||
expect(runtimeJob).toContain(target.sha256)
|
||||
}
|
||||
expect(runtimeScripts).toContain(
|
||||
"curl --proto '=https' --tlsv1.2"
|
||||
expect(scripts).toContain(
|
||||
'sudo apt-get install --no-install-recommends --yes rpm'
|
||||
)
|
||||
expect(runtimeScripts).toContain('--max-filesize 104857600')
|
||||
expect(runtimeScripts).toContain('sha256sum --check --strict -')
|
||||
expect(runtimeUses).toEqual(
|
||||
expect.arrayContaining([
|
||||
'actions/cache/restore@v6',
|
||||
'actions/cache/save@v6'
|
||||
])
|
||||
expect(scripts).toContain('rpmbuild --version')
|
||||
expect(scripts).toContain(
|
||||
'--platform ${{ matrix.platform }} --arch ${{ matrix.arch }}'
|
||||
)
|
||||
expect(runtimeUpload?.with?.name).toBe(
|
||||
'goodbuddy-agent-node-${{ matrix.arch }}'
|
||||
)
|
||||
expect(runtimeJob).toContain(
|
||||
'steps.node-runtime-cache.outputs.cache-hit != \'true\''
|
||||
)
|
||||
expect(runtimeJob).not.toContain('fail-on-cache-miss: true')
|
||||
expect(jobNeeds('agent-signing')).toEqual(
|
||||
expect.arrayContaining(['validate', 'agent-runtime'])
|
||||
)
|
||||
expect(signingJob).toContain('agent-runtime')
|
||||
})
|
||||
|
||||
it('passes the endpoint-derived region to every OSS upload', () => {
|
||||
expect(workflow).toContain(
|
||||
'https://oss-cn-beijing.aliyuncs.com'
|
||||
it('publishes only aggregated desktop assets through the existing OSS contract', () => {
|
||||
expect(jobNeeds('release')).toEqual([
|
||||
'authorize-release',
|
||||
'package'
|
||||
])
|
||||
expect(parsed.jobs.release?.environment?.name).toBe(
|
||||
'aliyun-oss-release'
|
||||
)
|
||||
expect(workflow).toContain('goodbuddy) ;;')
|
||||
expect(workflow).toContain(
|
||||
'oss_region="${endpoint_host#oss-}"'
|
||||
const release = serializedJob('release')
|
||||
const scripts = jobScripts('release')
|
||||
expect(release).toContain(
|
||||
'aliyun/configure-aliyun-credentials-action@v1'
|
||||
)
|
||||
expect(workflow).toContain(
|
||||
'echo "region=$oss_region" >> "$GITHUB_OUTPUT"'
|
||||
expect(scripts).toContain(
|
||||
'node build/aggregate-release.cjs'
|
||||
)
|
||||
expect(scripts).toContain(
|
||||
'node build/create-site-release.cjs'
|
||||
)
|
||||
expect(scripts).toContain(
|
||||
'node build/verify-site-release.cjs'
|
||||
)
|
||||
expect(scripts).toContain(
|
||||
'oss://${OSS_BUCKET}/releases/${GITHUB_REF_NAME}'
|
||||
)
|
||||
expect(scripts).toContain(
|
||||
'oss://${OSS_BUCKET}/releases/latest.json'
|
||||
)
|
||||
expect(
|
||||
[...workflow.matchAll(/--region "\$OSS_REGION"/gu)]
|
||||
).toHaveLength(2)
|
||||
})
|
||||
|
||||
it('allows fully unsigned macOS builds but rejects partial credentials', () => {
|
||||
expect(workflow).toContain('id: macos-signing')
|
||||
expect(workflow).toContain(
|
||||
'if [[ "$configured" -eq 0 ]]; then'
|
||||
)
|
||||
expect(workflow).toContain(
|
||||
'if [[ "$configured" -ne "${#names[@]}" ]]; then'
|
||||
)
|
||||
expect(workflow).toContain(
|
||||
'Build unsigned macOS release packages'
|
||||
)
|
||||
expect(workflow).toContain('--skip-build --unsigned')
|
||||
expect(workflow).toContain(
|
||||
"steps.macos-signing.outputs.enabled == 'true'"
|
||||
)
|
||||
expect(workflow).toContain(
|
||||
"steps.macos-signing.outputs.enabled == 'false'"
|
||||
)
|
||||
expect(workflow).toContain(
|
||||
'Apple signing credentials are not configured'
|
||||
it('retains macOS signed and explicit unsigned release modes', () => {
|
||||
const scripts = jobScripts('package')
|
||||
expect(scripts).toContain('--skip-build --unsigned')
|
||||
expect(serializedJob('package')).toContain(
|
||||
'"CSC_LINK":"${{ runner.temp }}/goodbuddy-developer-id.p12"'
|
||||
)
|
||||
expect(scripts).toContain('xcrun stapler validate')
|
||||
expect(scripts).toContain('spctl --assess')
|
||||
})
|
||||
})
|
||||
|
||||
@@ -76,7 +76,6 @@ type RemoteRuntimeBundleModule = {
|
||||
preflightProductionSigningKey(options: {
|
||||
projectRoot: string
|
||||
environment: NodeJS.ProcessEnv
|
||||
lock: RemoteRuntimeLock
|
||||
registry: AgentReleaseKeyRegistry
|
||||
}): unknown
|
||||
verifyBundleDirectory(
|
||||
@@ -294,10 +293,33 @@ describe('Remote Runtime bundle tooling', () => {
|
||||
runtimeBundle.preflightProductionSigningKey({
|
||||
projectRoot: process.cwd(),
|
||||
environment: {},
|
||||
lock,
|
||||
registry
|
||||
})
|
||||
).toThrow(/are required for production Runtime signing/iu)
|
||||
).toThrow(/signing key ID before building a release/iu)
|
||||
})
|
||||
|
||||
it('preflights a registered production key without reading its private key', () => {
|
||||
const productionRegistry: AgentReleaseKeyRegistry = {
|
||||
...registry,
|
||||
keys: registry.keys.map((key) => ({
|
||||
...key,
|
||||
environment: 'production'
|
||||
}))
|
||||
}
|
||||
|
||||
expect(
|
||||
runtimeBundle.preflightProductionSigningKey({
|
||||
projectRoot: process.cwd(),
|
||||
environment: {
|
||||
GOODBUDDY_REMOTE_RUNTIME_SIGNING_KEY_ID:
|
||||
'runtime-fixture'
|
||||
},
|
||||
registry: productionRegistry
|
||||
})
|
||||
).toMatchObject({
|
||||
keyId: 'runtime-fixture',
|
||||
environment: 'production'
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
|
||||
@@ -48,8 +48,8 @@ const targetDefinitions = [
|
||||
['windows', 'arm64', ['nsis', 'portable']],
|
||||
['macos', 'x64', ['dmg', 'zip']],
|
||||
['macos', 'arm64', ['dmg', 'zip']],
|
||||
['linux', 'x64', ['AppImage', 'deb']],
|
||||
['linux', 'arm64', ['AppImage', 'deb']]
|
||||
['linux', 'x64', ['AppImage', 'deb', 'rpm']],
|
||||
['linux', 'arm64', ['AppImage', 'deb', 'rpm']]
|
||||
] as const
|
||||
|
||||
function createAggregateManifest() {
|
||||
@@ -145,7 +145,7 @@ describe('site release manifest', () => {
|
||||
|
||||
await expect(
|
||||
verifier.verifySiteRelease(manifest, request)
|
||||
).resolves.toBe(12)
|
||||
expect(request).toHaveBeenCalledTimes(12)
|
||||
).resolves.toBe(14)
|
||||
expect(request).toHaveBeenCalledTimes(14)
|
||||
})
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user